Robert Syrnicki
73c96cab56
Two gaps found while walking through a real single-tenant deployment scenario, both fixed and verified against the actual running stack (not just unit tests): - wg-easy moves to network_mode: host so Traefik can actually route to WireGuard peer addresses (wg-quick's route only existed inside wg-easy's own isolated network namespace before). This forced host-level sysctls (ops/host-sysctls.sh — Docker/runc rejects namespaced sysctls under host networking) and a host firewall rule (ops/firewall.sh) to keep wg-easy's now-unisolated admin API off the public interface. - control-plane gets a real Traefik route (traefik/dynamic/control-plane.yml.example) instead of being reachable only at 127.0.0.1:8090 — box registration carries a WireGuard private key and needs TLS, not bare loopback HTTP. Along the way, running the actual pinned wg-easy image (ghcr.io/wg-easy/wg-easy:14) surfaced that it's a different, older, Express-based codebase than what wg-easy's current docs/master branch describe: auth is a plain Authorization header per request (no session cookie), routes live under /api/wireguard/client, and its default WG_ALLOWED_IPS is full-tunnel (0.0.0.0/0) rather than the split-tunnel this design assumed. wgeasy.py and docker-compose.yaml are corrected accordingly, verified end-to-end against the real container. Also fixed: Docker Compose silently truncates a bcrypt hash's `$` characters when read from .env — documented the required $$ escaping.
34 lines
1.1 KiB
Bash
Executable file
34 lines
1.1 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Set the two kernel sysctls wg-easy needs, directly on the VPS host.
|
|
#
|
|
# Why this can't just be docker-compose.yaml's `sysctls:` key: that key
|
|
# sets namespaced (per-network-namespace) sysctls inside a container's own
|
|
# network namespace. wg-easy runs with network_mode: host (see the comment
|
|
# on that service), which means it has no network namespace of its own —
|
|
# runc flatly refuses to start the container if `sysctls:` is set at all
|
|
# under host networking ("not allowed in host network namespace"),
|
|
# confirmed by actually trying it, not assumed. These have to be host-level
|
|
# settings instead.
|
|
#
|
|
# Run this once on the VPS, before `docker compose up -d`.
|
|
|
|
set -euo pipefail
|
|
|
|
if [[ $EUID -ne 0 ]]; then
|
|
echo "must be run as root" >&2
|
|
exit 1
|
|
fi
|
|
|
|
CONF_FILE=/etc/sysctl.d/99-furtka-gateway.conf
|
|
|
|
cat > "$CONF_FILE" <<'EOF'
|
|
# Required by furtka-gateway's wg-easy service (network_mode: host) — see
|
|
# docker-compose.yaml and ops/host-sysctls.sh.
|
|
net.ipv4.ip_forward=1
|
|
net.ipv4.conf.all.src_valid_mark=1
|
|
EOF
|
|
|
|
sysctl --system >/dev/null
|
|
|
|
echo "Applied and persisted (via $CONF_FILE):"
|
|
sysctl net.ipv4.ip_forward net.ipv4.conf.all.src_valid_mark
|